But you can always use shrink-wrap or other package managers that guarantee immutability.
Oh, I guess I should say I love npm/yarn and use it as a core of all my projects. ️